Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward OpenAPI/Swagger documentation helper with somewhat broad activation wording but no hidden execution, persistence, credential access, or destructive behavior.
Install this if you want help with OpenAPI, Swagger, or REST API documentation. Because the activation wording is broad, prefer invoking it explicitly for API documentation tasks and do not assume it is the right skill for every general API or developer-experience question.
The trigger sentences are broad, repetitive, and partly templated, which increases the chance the skill will be invoked for loosely related requests rather than explicit user intent. In an agent system, unintended invocation can route user data or workflow control to the wrong skill, causing incorrect actions, confused delegation, or accidental disclosure of context to an unnecessary component.
The trigger phrases are broad and generic enough that the skill may activate for loosely related requests, causing unintended routing or over-invocation. In an agent ecosystem, ambiguous activation can lead to incorrect tool/skill selection, unexpected access to context, and reduced user control over when this skill is used.
The skill description activates on very broad terms such as 'software-and-data', 'openapi', 'swagger', and 'rest api', which can cause the skill to be invoked in contexts where the user did not actually ask for documentation-generation help. Over-broad routing increases the chance of inappropriate skill selection, irrelevant guidance, and prompt-scope interference with other more suitable skills.
The listed trigger keywords are generic and high-volume terms that may appear in many unrelated developer conversations, causing accidental invocation of this skill. In an agent system, ambiguous keyword triggers can degrade security and reliability by routing requests to a skill whose instructions or assumptions do not fit the user's actual goal.
The skill description includes broad trigger terms such as software-and-data, openapi, swagger, api documentation, and rest api, which can match many ordinary technical requests beyond the skill’s intended scope. This can cause the agent to invoke the skill in unrelated contexts, leading to misrouting, irrelevant guidance, or accidental application of workflow assumptions to the wrong task.
The keyword trigger list relies on generic terms without qualifiers, especially software-and-data, openapi, swagger, api documentation, and rest api. In a skill-routing system, such broad keywords can overmatch common requests and cause inappropriate skill selection, reducing reliability and potentially bypassing more suitable specialized skills.
The skill enables implicit invocation without any narrowly scoped activation constraint, which can cause the agent to invoke this skill in situations that only loosely match the broad description. Because the skill concerns document generation and validation workflows, unintended invocation could expose user data or cause the model to over-trust and act on the skill in contexts where it was not explicitly requested.
The trigger sentence begins with a very broad everyday phrase ('Help me ...'), which can cause the skill to activate in contexts far beyond OpenAPI/Swagger documentation work. Over-broad activation increases the chance of unintended routing, prompt confusion, or misuse of the skill in unrelated conversations, which can degrade safety controls and produce irrelevant or misleading outputs.
The sentence 'I need a practical workflow for ...' is generic enough to match many benign requests that are not actually asking for OpenAPI documentation support. This broad matching can trigger the skill unexpectedly, creating unnecessary exposure to adversarial or irrelevant inputs and reducing the reliability of skill selection.
No suspicious patterns detected.
